What Is CUI? How to Recognize Controlled Unclassified Information

Controlled Unclassified Information (CUI) is government information that is not classified but that a law, regulation or government-wide policy requires or permits to be protected. For contractors, it usually arrives as technical drawings, specifications or program data under a contract, and it triggers the NIST SP 800-171 security requirements.

Knowing whether you hold CUI is the first decision in any CMMC or NIST SP 800-171 effort, because it determines which requirements apply and which systems are in scope. It is also where many companies get it wrong in both directions: treating everything as CUI, or assuming nothing is because nothing is stamped.

What is the legal definition of CUI?

The CUI program was established by Executive Order 13556 in 2010, with the National Archives (NARA) as its executive agent, and is implemented in 32 CFR Part 2002 (NARA CUI program, retrieved 2026-09-29). The regulation defines CUI as:

"Information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls." (32 CFR 2002.4, retrieved 2026-09-29)

Two parts of that definition matter to contractors. First, information your company creates for the government can be CUI, not only information the government hands you. Second, there must be an authority behind it: CUI is not a label for anything that feels sensitive.

What is the difference between CUI Basic and CUI Specified?

32 CFR 2002.4 divides CUI into two subsets:

• CUI Basic is CUI for which the authorizing law, regulation or policy "does not set out specific handling or dissemination controls." The standard CUI safeguards apply.
• CUI Specified is CUI where the authority "contains specific handling controls that it requires or permits agencies to use that differ from those for CUI Basic." Export-controlled information is a common example; the extra controls come from the export rules themselves.

The CUI Registry, which the regulation describes as "the online repository for all information, guidance, policy, and requirements on handling CUI," lists every category and its authority. It is organized into groupings such as Defense, Export Control, Privacy and Proprietary Business Information; Controlled Technical Information sits under Defense (NARA CUI Registry, retrieved 2026-09-29).

How is CUI different from FCI and covered defense information?

These terms overlap and are often confused.

All CUI you hold under a defense contract is effectively FCI as well, but most FCI is not CUI. An invoice or a delivery schedule is usually FCI; a technical drawing with a distribution restriction is usually CUI.

How is CUI marked, and what if it is not?

The banner marking on CUI uses the control marking "CONTROLLED" or the acronym "CUI" (32 CFR 2002.20, retrieved 2026-09-29). In defense work, technical documents also commonly carry a distribution statement restricting who may receive them.

Three practical rules follow from the regulation:

1. Old markings do not count. Legacy markings such as "For Official Use Only" are void under the CUI program; they no longer indicate by themselves that information is CUI.
2. A missing marking does not remove the obligation. 32 CFR 2002.20 states: "The lack of a CUI marking on information that qualifies as CUI does not exempt the authorized holder from abiding by applicable handling requirements."
3. When in doubt, ask the contracting officer or your prime. Your contract, and the prime that flowed it to you, should identify what information is controlled. Get the answer in writing.

Where does CUI actually live in a company?

Once CUI arrives, it spreads. Walk through each of these and ask whether CUI could be there:

• Email. Drawings and specifications usually arrive as attachments, then get forwarded internally.
• File shares and cloud storage. Project folders, shared drives, and synced folders on laptops.
• Engineering and production systems. CAD workstations, CAM programming, inspection equipment and machine controllers that load part programs.
• Personal and mobile devices. Phones that receive email, home computers used for remote work, USB drives.
• Backups. Every backup of a system holding CUI also holds CUI, including cloud backup services.
• Third parties. IT providers, cloud services, and subcontractors you share files with.
• Paper. Printed drawings on the shop floor and in filing cabinets.

The result of this walk is your scope: the people, systems and locations that must meet NIST SP 800-171. Many small suppliers find it more practical to confine CUI to a smaller, well-controlled environment than to bring every system in the company up to the requirement.

What should you do if you think you hold CUI?

1. Collect the contracts and subcontracts that include DFARS 252.204-7012 or reference CUI.
2. Ask the prime or contracting officer to confirm which information is CUI.
3. Map where that information goes, using the list above.
4. Stop the spread while you plan: fewer copies means a smaller scope.
5. Assess the in-scope systems against NIST SP 800-171 Rev 2 and record an honest SPRS score.

The wider picture of clauses, CMMC levels and what is in force during the current program suspension is in our CMMC and NIST SP 800-171 guide.

If you want help working out where CUI lives in your environment, request an assessment.